Kiteworks patches flaw allowing remote takeover of email gateway
Image: Primary Kiteworks released updates addressing 126 vulnerabilities, including a maximum-severity flaw that can let unauthenticated remote attackers take over its Email Protection Gateway. Tracked as CVE-2026-54154, the flaw affects every gateway release before 9.4.1 and is patched in 9.4.1 or later.
Attackers can chain path traversal, code injection and missing authentication to execute code without user interaction, then exploit additional local weaknesses to gain root control. The updates also fix 11 critical vulnerabilities in Kiteworks' Core and gateway components. Shadowserver tracks nearly 400 internet-exposed Kiteworks instances, but does not identify how many are patched or are honeypots.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
